PT-2017-15712 · Oracle · Oracle Fusion Middleware Mapviewer

Published 2017-04-19 · Updated 2019-10-03 · CVE-2017-3230

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:C/A:P

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware MapViewer versions 11.1.1.9, 12.2.1.1, 12.2.1.2

Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Fusion Middleware MapViewer. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data, as well as unauthorized read access to a subset of Oracle Fusion Middleware MapViewer accessible data. Additionally, it can cause a partial denial of service of Oracle Fusion Middleware MapViewer.

Recommendations For versions 11.1.1.9, 12.2.1.1, and 12.2.1.2, consider restricting access to the MapViewer component until a patch is available. As a temporary workaround, consider disabling the FileUploaderServlet to minimize the risk of exploitation. Avoid using the fileName parameter in the affected HTTP endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2017-3230

ZDI-17-288

Affected Products

Oracle Fusion Middleware Mapviewer

References · 6

• https://osv.dev/vulnerability/CVE-2017-3230 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-17-288 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-3230 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html · Vendor Advisory
• http://securityfocus.com/bid/97746 · Note
• http://securitytracker.com/id/1038291 · Note